Location: Canberra, Australian Capital Territory (ACT) (remote considered)Security Clearance: Baseline ClearanceThreat Detection EngineeringSIEM use case development and detection content creationDetection rule development and tuningSOAR playbook developmentSTRIDEMITRE ATT&CKAttack; path analysisDetection coverage assessmentGap analysisThreat intelligence integration and managementResearch into emerging threatsIntelligence sharing across infrastructure and architecture teamsSecurity OperationsSOC operationsITIL and Agile environmentsAI Security (Important New Requirement)The RFQ specifically calls for experience in:AI threat modellingAI-related data leakage monitoringAdversarial AI activity detectionSecurity monitoring of AI platforms, services and agentsA strong candidate would typically have:5+ years in SOC, Detection Engineering, Threat Hunting, or Cyber Security OperationsHands-on experience with platforms such as:Microsoft SentinelSplunkQRadarCrowdStrikeStrong understanding of MITRE ATT&CKExperience; integrating threat intelligence feedsGood documentation and stakeholder engagement skillsEvaluation Themes to Address in a SubmissionWhen preparing a candidate response, focus on evidence demonstrating:Development of threat detection use cases and rules.SIEM/EDR content engineering and tuning.Threat modelling expertise using STRIDE and ATT&CK.Threat; intelligence integration and analysis.Experience supporting incident response activities.Security monitoring of cloud and on-premises environments.AI security and emerging threat detection capabilities.Working within Agile and ITIL environments.Requirements1.




Detection Engineering and SIEM Expertise - Demonstrated experience developing detection content across at least two enterprise SIEM platforms (e.g. Splunk, Microsoft Sentinel, QRadar, Elastic).2.
Threat Detection and Response Capability - Experience developing and implementing detections across SIEM, SOAR and EDR platforms, including incident response automation and playbook development.3.
Threat Modelling and Threat Intelligence - Practical experience conducting threat modelling using recognised methodologies (e.g. STRIDE, PASTA, ATT&CK;) and translating outcomes into detection and monitoring requirements, supported by a solid understanding of the cyber threat intelligence lifecycle.4.
AI Security Monitoring - Experience identifying, assessing and developing monitoring controls for AI-related security risks, including enterprise AI platforms such as Microsoft Copilot or Azure AI.5.
Cyber Security Operations Experience - Minimum five years' experience in cyber security operations, supported by strong organisational, communication and stakeholder engagement skills.1.
Sigma Rule Development - Experience developing or using Sigma detection rules and translating detections between security platforms.2.
Advanced AI Security Knowledge - Familiarity with AI security frameworks and guidance, including ASD/ACSC, NIST, MITRE ATLAS and OWASP LLM Top 10.
Relevant industry certifications such as GIAC, SANS, CISSP, GCIA, GCIH or equivalent cyber security qualifications.3.
EDR Platform Expertise - Experience with enterprise EDR technologies such as CrowdStrike, Microsoft Defender for Endpoint and Carbon Black.4.
Automation and Scripting - Proficiency in scripting languages such as Python and Bash to support detection engineering and security automation activities.
#J-*****-Ljbffr

📌 Soc Detection Specialist (Canberra)
🏢 Powerdatagroup
📍 Canberra